The Mysterious 1e100.net

If you are the type of tech junkie who likes to dig into your Internet access logs to look at your incoming and outgoing Internet connections, you may have noticed that the domain “1e100.net” pops up once in a while, seemingly without rhyme or reason. In some instances you may even have a persistent connection to 1e100.net, even as soon as you start your computer.

What on Earth is 1e100.net? Well, if you are enough of a math geek, you know that the “e” symbol stands for exponentiation, and “1e100” means 1×10 to the 100th power. That’s a big number…in fact, it’s a number so large that it’s called a “googol” – a one followed by 100 zeroes. Hmmm, googol, googol…what’s familiar about that word? Ah yes – it sounds just like Google. And that’s because Google is named after googol, and 1e100.net is one of Google’s domains. A WHOIS lookup for that domain reveals it’s owned by them.

Because many power users aren’t aware of this connection, their first reaction upon seeing 1e100.net pop up in in a network management program, such as a software-based firewall, is to block it because they don’t know what it is. It further freaks people out if it shows up as a persistent connection that they can’t get rid of. However, it is a perfectly harmless connection and there’s no need for panic. The 1e100.net domain will never show up by itself. It will always be a subdomain such as server-name.1e100.net.

Instances where you will see the 1e100.net connection

(By “see” I mean viewing from a network utility that can closely monitor all network requests.)

Any web page that has embedded YouTube video

For YouTube itself (a Google property) or any other web site that has a YouTube video embedded in it, 1e100.net will show up even if the video isn’t loaded. When the Flash player first launches it makes a request to YouTube for the video thumbnail image and therefore sends a request to 1e100.net for that data.

Firefox “safe browsing”

This feature by default is enabled and uses a Google server to check web sites you load to see if they’re in the “bad” list.

This is located from Tools / Options / Security:

The two checkboxes “Block reported attack sites” and “Block reported web forgeries” enable Firefox to check every single web site you load against the “bad” list Google has.

Uncheck these two boxes if you don’t want where you surf to be checked against the Google list.

If you want to see the actual configuration data for this, load the address about:config in Firefox, then search for safebrowsing, like this:

You don’t have to necessarily do anything here, but if you wanted to know “How much Google is in my Firefox?”, there’s your answer.

Google Earth / Google Updater

Both Earth and Updater (which Earth installs by default) will make connections to 1e100.net to check for updates.

You can instruct Updater not to do that if so desired.

Other places?

As far as I’m aware, the three above instances are where you will see 1e100.net appear. Now that you’re aware what it is and its purpose, you now know it’s not spyware or malware. It’s Google. Using a weird domain because.. um.. well.. it’s a long story and we’ll leave it at that. :)